System and method trusted workspace in commercial mobile devices

ABSTRACT

A system and method for creating a trusted workspace on a commercial mobile device using a cryptographic security token having a secure microprocessor, a secure bus connected to said secure microprocessor, a bus isolation microcontroller connected to said secure bus wherein said bus isolation microcontroller comprises firmware for controlling communications through said secure bus to said secure microprocessor, a first NFC antenna connected to said bus isolation microcontroller, and a second NFC antenna connected to said secure microprocessor. The secure microprocessor and said bus isolation microprocessor are powered by energy received through said first NFC antenna and said second NFC antenna. The cryptographic security token receives data from outside said cryptographic security token only through said first NFC antenna. The token or module may further have a bi-state or bi-stable display and a secure memory, each connected to the secure microprocessor by a secure bus.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims the benefit of the filing date of U.S.Provisional Patent Application Ser. No. 62/556,302 filed by the presentinventors on Sep. 8, 2017 and U.S. Provisional Patent Application Ser.No. 62/562,329 filed on Sep. 22, 2017.

The present application further is a continuation-in-part of U.S. patentapplication Ser. No. 15/730,929, which claims the benefit of the filingdate of U.S. Provisional Patent Application Ser. No. 62/562,329 filed bythe present inventors on Sep. 22, 2017.

The aforementioned provisional and non-provisional patent applicationsare hereby incorporated by reference in their entirety.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

None.

BACKGROUND OF THE INVENTION Field of the Invention

The present invention relates to a system and method for providing atrusted workspace in commercial mobile devices.

Brief Description of the Related Art

In many access control situations there can be overlapping credentialsrequired to successfully access a particular asset. These can bedescribed as Trusted Work Space Access requirements and in mostchpervisorases they have to be exercised in the correct sequence.

An illustrative example is access to a locked closet in a locked home,two keys needed, one for the house, one for the closet. They have to beused in the right order to get at the contents of the closet. And if youalso need access to a second closet you would need a third key. Anotherconsideration here is who grants access, or who is the owner of thedesired contents. In this case the owners of each of these keys can bedifferent and they can have different requirements placed on the personprivileged to use the key. For the first key, the key to the house, youmight have to prove to the mortgage holder that you are the owner orhave the owner's permission. If the second key is to an electricalcloset you might have to prove that you are a qualified electrician togain access and the third to the food pantry, with access only allowedfor the cook. Another important consideration is that this second key ismade available only to someone who has access to the house in the firstplace. This proves that the person has initially proven his identity.Hiding the second key in the house accomplishes this.

The point of this analogy is that access and authorization for thisprocedure can have many facets. It is called Trusted Work Space andrequires a sequential control process to gain access to its innercontents.

The same needs hold true in accessing information systems, basicsecurity clearances have to be proven (the first key) before access isgiven to special categories of information, or compartments(second/third keys). Basic security clearances are given afterbackground checks by the governing body and compartment accesses areapproved by the data owner, the “need to know” and the determinationthat accesses is required to perform one's job. Access records are keptsecurely and special responsibilities explained and accepted both whenaccess is granted and when it is withdrawn. Management of these twolevels of access also tend to be separate because of differentownerships. The rules would apply to physical as well as logical access.

SUMMARY OF THE INVENTION

A cryptographic module and mobile device can play an essential role in awide variety of information access phases, in conjunction with itsassociated Smartphone, from the basic access procedures to the auditingof transactions. But there is an added hazard—that of keystrokerecording malware. This is malicious software that has been introducedinto the system without the owner's knowledge via various means,phishing and downloading from outlaw websites included, which willrecord any sensitive data entries. Once introduced into the system itwould be capable of recording any subsequent password entry for lateruse. Passwords are particularly vulnerable because they can be used canbe used for illegal entry at a later time. The concern is not totalprevention of this introduction (very difficult if not impossible) butto ensure that this malware will not be able to record passwords thatare used for special compartment access (the second key). In a preferredembodiment of the present invention, a cryptographic module and mobiledevice is used to perform a method capable of circumventing therecording of this second password entry.

The cryptographic module and smartphone and methods of the presentinvention circumvent vulnerabilities and protects a smartphone's orother mobile device's external wireless interfaces. Rather than replacea credit card with the smartphone or other mobile device, the securityarchitecture of the present invention employs a token tethered to asmartphone or other mobile device through an NFC channel in the mobiledevice. The present invention is compliant with current ISO standard NFCprotocols and technology and introduces a new class of security tokenreferred to herein as a “cryptographic module,” “Crypto Module” or “CM.”The CM integrates two (2) NFC antennas to parasitically power the CM.However, during the power up sensing phase, the system disables one ofthe crypto module NFC data communication ports to thereby establish asingle trusted and isolated I/O data channel between the mobile deviceand CM.

In a preferred embodiment, the present invention is a system and methodfor creating a trusted workspace on a commercial mobile device using acryptographic security token having a secure microprocessor, a securebus connected to said secure microprocessor, a bus isolationmicrocontroller connected to said secure bus wherein said bus isolationmicrocontroller comprises firmware for controlling communicationsthrough said secure bus to said secure microprocessor, a first NFCantenna connected to said bus isolation microcontroller, and a secondNFC antenna connected to said secure microprocessor. The securemicroprocessor and said bus isolation microprocessor are powered byenergy received through said first NFC antenna and said second NFCantenna. The cryptographic security token receives data from outsidesaid cryptographic security token only through said first NFC antenna.The token or module may further have a bi-state or bi-stable display anda secure memory, each connected to the secure microprocessor by a securebus.

Essentially, implementing NFC in this unique configuration allows aseparate hardware based crypto module to be securely linked to acommercial smartphone without embedding custom hardware. Thesmartphone/CM are paired to each other below the mobile device(smartphone) operating system via NFC. The smartphone/CM solutionsecures applications, protect sensitive user data, firewalls trustedworkspaces, and isolates smartphone peripherals from unauthorized accessand pernicious attacks.

In a preferred embodiment, the present invention is a system foroverlaying security to the baseband NFC communication layers of thesmartphone to establish a hardware-based root of trust or hardwaretrusted execution environment using the CM.

In a preferred embodiment, the present invention comprises acryptographic security token having a secure microprocessor, a securebus connected to said secure microprocessor, a bus isolationmicrocontroller connected to said secure bus wherein said bus isolationmicrocontroller comprises firmware for controlling communicationsthrough said secure bus to said secure microprocessor, a first NFCantenna connected to said bus isolation microcontroller, and a secondNFC antenna connected to said secure microprocessor. The securemicroprocessor and said bus isolation microprocessor are powered byenergy received through said first NFC antenna and said second NFCantenna. The cryptographic security token receives data from outsidesaid cryptographic security token only through said first NFC antenna.

The cryptographic security token may further comprise a bi-state orbi-stable display and a second secure bus between the display and thesecure microprocessor. The second secure bus has fully programmableirreversible bit mapping of an order between a least significant bit anda most significant bit within a data address and provides unique dataaddressing of data being transmitted from the secure processor to thedisplay. The irreversible bit mapping may comprise fusible links ormeans.

The cryptographic security token may further comprise a secure memoryand another secure bus between the secure memory and the securemicroprocessor, wherein the second secure bus has fully programmableirreversible bit mapping of an order between a least significant bit anda most significant bit within an data address and provides unique dataaddressing of data being transmitted from the secure processor to thedisplay.

The cryptographic security token may further comprising energyharvesters connected to said first and said second NFC antennas.

The secure microprocessor, said secure bus, and said bus isolationmicrocontroller are formed on a thin film printed circuit board and mayfurther comprise an epoxy-based conformal coating over said thin filmprinted circuit board. The conformal layer may have properties thatblock probing using X-rays, focused electron and ion beam scanning andscanning electron microscopy. In another embodiment, the conformal layercomprises a potting material comprising at least one material selectedfrom the group of urethane, epoxy and ceramic; a compound mixed withinsaid potting material; a mineral; and an anti-tamper film embeddedwithin said potting material. The compound comprises one or more ofmetals, heavy metals, graphone, carbon, carbon fullerene structures,synthetic diamond dust and quantum dots. The anti-tamper film comprisesan active or passive anti-tamper mesh film. In yet another embodiment,the conformal layer comprises an ultraviolet epoxy and a compound forpreventing removal of the conformal layer with acid or etchingtechniques without damaging any portion of the underlying printedcircuit board. The compound may comprise one or more shieldingcomponents selected from the group of ground metal compounds, graphene,carbon nanotubes, synthetic diamond and quantum dots.

The cryptographic security token may further comprise a UV curedadhesive material over said conformal coating. The cryptographicsecurity token may further comprise a waterproof synthetic printingmedium over said UV cured adhesive material, wherein polyolefinhydrophilic properties of the waterproof synthetic printing medium arecustom infused with micro-taggants that fluoresce or leach die whenprobed.

The cryptographic security token may be the in the form of a card or insome other form.

In another embodiment, the cryptographic security token furthercomprises a voltage glitch detector for detecting power pulses in saidsecurity token. The voltage glitch detector comprises a comparatorconnected to a power bus in said cryptographic security token and to areference voltage.

In yet another embodiment, the cryptographic security token may furthercomprise a secure memory; and an over/under temperature sensor anddetector circuit for monitoring a temperature of said secure memory.

In a preferred embodiment, the present invention is a method forcreating a trusted workspace on a mobile device using a cryptographicsecurity token comprising a secure microprocessor, a secure busconnected to said secure microprocessor, a bus isolation microcontrollerconnected to said secure bus, said bus isolation microcontrollercomprising firmware for controlling communications through said securebus to said secure microprocessor, a first NFC antenna connected to saidbus isolation microcontroller, and a second NFC antenna connected tosaid secure microprocessor, wherein said secure microprocessor and saidbus isolation microprocessor are powered by energy received through saidfirst NFC antenna and said second NFC antenna, and wherein saidcryptographic security token receives data from outside saidcryptographic security token only through said first NFC antenna. Themethod comprises the steps of provisioning the cryptographic module andthe mobile device, initializing and booting up the cryptographic moduleand the mobile device; and transitioning the cryptographic module andthe mobile device into the trusted work space. The provisioning of thecryptographic module comprises registering a user in the cryptographicmodule to establish the user's identity. creating authenticationcertificates associated with said user, loading private keys on to thecryptographic module and the mobile device. creating a first userpassword to enable access to a basic system on said mobile device andstoring the first user password in the cryptographic module, creating arandom password and loading said random password into a register on thecryptographic module, the random password only being accessible to theuser through a secure display on the cryptographic module, and storing alow-level bootloader in the cryptographic module. The initializing andbooting up of the cryptographic module comprises verifying the low-levelbootloader with the cryptographic module, initiating, executing, andvalidating a secondary bootloader, verifying the operating system kernelwherein the verifying comprises verifying a large block of source codethat bridges software and hardware in the mobile device, and verifyingmandatory code signing for the operating system to applications in themobile device. The transitioning the cryptographic module and the mobiledevice into the trusted work space comprises writing immutable data andcode in separate memory containers within the cryptographic module aswell as a split key to the mobile device.

Still other aspects, features, and advantages of the present inventionare readily apparent from the following detailed description, simply byillustrating a preferable embodiments and implementations. The presentinvention is also capable of other and different embodiments and itsseveral details can be modified in various obvious respects, all withoutdeparting from the spirit and scope of the present invention.Accordingly, the drawings and descriptions are to be regarded asillustrative in nature, and not as restrictive. Additional objects andadvantages of the invention will be set forth in part in the descriptionwhich follows and in part will be obvious from the description, or maybe learned by practice of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention and theadvantages thereof, reference is now made to the following descriptionand the accompanying drawings, in which:

FIG. 1 is a front view of a cryptographic module and mobile device inaccordance with a preferred embodiment of the present invention.

FIG. 2 is a diagram illustrating multiple layers of security provided byembodiments of the present invention.

FIG. 3A is a block diagram of a system having a cryptographic module anda mobile device in accordance with a preferred embodiment of the presentinvention.

FIG. 3B is a block diagram of a front side of a cryptographic module ina card form in accordance with a preferred embodiment of the presentinvention.

FIG. 3C is a block diagram of an obverse or back side of a cryptographicmodule in a card form in accordance with a preferred embodiment of thepresent invention.

FIG. 4 is a flow chart of a power up sequence of a cryptographic modulein accordance with a preferred embodiment of the present invention.

FIG. 5 is a flow chart of a method for establishing secure processingusing cryptographic module trusted hardware in accordance with apreferred embodiment of the present invention.

FIG. 6 is a flow chart of a method for establishing an NFC cryptographicmodule as a trusted hardware execution environment for a mobile devicein accordance with a preferred embodiment of the present invention.

FIG. 7 is a flow chart of a method for boot-up of an NFC cryptographicmodule as a trusted hardware execution environment for a mobile devicein accordance with a preferred embodiment of the present invention.

FIG. 8 is a block diagram of a system architecture in accordance with apreferred embodiment of the present invention.

FIG. 9 is a block diagram of an architecture of a system in accordancewith a preferred embodiment of the present invention.

FIG. 10 is a flow chart illustrating a method for provisioning securecode for nested access privileges.

FIG. 11 is a bock diagram of secure memory containers in a secure memoryof a cryptographic module in accordance with a preferred embodiment ofthe present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The preferred embodiments of the inventions are described with referenceto the drawings. A typical operational configuration between asmartphone 100 and a crypto module 200 is shown in FIG. 1. Smartphonevendors embed the NFC antenna in various locations inside the back(non-metallic) cover. A simple sleeve is sometimes added to guide andalign crypto module 200 inductive antenna coil with the smartphoneantenna.

The present invention provides a localized security architecture for asmartphone based upon an NFC crypto module. The crypto module is thehardware trust anchor when connected to a smartphone. A layered approachis presented providing a defense-in-depth (DID) solution.

The software/firmware layered around the CM that address most threatsand vulnerabilities is described with reference to FIG. 2. For clarity,we define the localized security ontology envisioned as a plurality ofsecurity layers. Each security layer encompasses one or more securityattributes, services, or functions in the system. The layered designprovides defense-in-depth protection even against National State levelof attacks with knowledge and equipment resources.

FIG. 2 illustrates multiple layers of security:

Layer 1: The Programmable Crypto Processor (242);

Layer 2: Active/Passive Tamper Circuitry in the Crypto Processor IC(243);

Layer 3: Bus Isolation Processor (230);

Layer 4: Trusted CM Display (260);

Layer 4.5 Trusted buses (232, 243);

Layer 5: Trusted Memory Containers (244);

Layer 6: Crypto Module (200);

Layer 7: Anti Tamper/Tamper Evident CM Encapsulation (201);

Layer 8: Crypto Processor/Secure Element in Smartphone (112);

Layer 9: Smartphone NFC Transceiver Chip (110);

Layer 10: Encrypted NFC Channel (310);

Layer 11: Type 1 Hybrid Hypervisor (320);

Layer 12: Trusted Work Space (330);

Layer 13: Smartphone OS (140);

Layer 14 Commercial Smartphone (100);

Layer 15: Internet of Things (IoT) Peripherals (340);

Layer 16: Biometric Sensors I/O Peripherals (350);

Layer 17: Generic I/O Peripherals (360);

Layer 18: Secure Boot Loader (370);

Layer 19: Trusted Applications (380); and

Layers 20-21: Custom Baseband Cellular Peripheral (390, 392).

The present invention relates specifically to the cryptographic moduleor token and thus to specific ones of these layers of security, morespecifically, Layer 1 (The Programmable Crypto Processor), Layer 2(Active/Passive Tamper Circuitry in the Crypto Processor IC; Layer 3(Bus Isolation Microprocessor); Layer 4 (Trusted CM Display); Layer 4.5(Trusted Buses), Layer 6 (Crypto Module) and Layer 7 (Anti Tamper.Tamper Evident CM Encapsulation).

Layer 1: the Programmable Crypto Processor

The fully programmable cryptographic processor (242) is a separateintegrated circuit (IC) within the CM. This chip 242 executes all themost trusted cryptographic functions. With an embedded general-purpose8051 microprocessors, it also integrates three (3) math co-processorsfor single command execution of Elliptic Curves, AES, and 3DESalgorithms. The crypto processor includes over 100 layers of security.

Layer 2: Active/Passive Tamper Circuitry of the Crypto Processor Chip

As described in Table 1, the crypto processor chip 242 has both active,passive, and design layout features that protect the functions and datacontents of the cryptographic processor chip. Active tamper sensors inthe CM are only powered when the CM is powered by the smartphone. Whenpower is removed from the CM the crypto processor sensitive data storedwithin volatile memory is removed through known means for wiping data involatile memory.

Layer 3: Bus Isolation Processor

The primary function of employing a separate bus processor 230 embeddedwithin the CM is to isolate and secure the internal bus from outsideaccess from intentional intrusion. The security functionality of the BusIsolation processor chip 230 is detailed in the next two sections. It isan important function to switch the NFC bus control from the smartphoneto the CM and to physically isolate the vulnerable data bus within theCM from access by the smartphone and outside world.

Layer 4: Trusted CM Display

The crypto module has been designed with its own separate secure display260, referred to herein as a “trusted display.” It is typical of mostsecure CM operations that eight or more individual security functions(i.e. unlocking a trusted smartphone app) are executed in series.Consequently, status, intermediate results, alerts, interrupts, andprompts all are displayed on the trusted CM display.

Not only does the trusted display 260 provide user feedback while secureprocesses are being executed but also it provides instant notices if anyattacks or policy breaches occur. For example, if a data breach attemptby a hacker occurs in the hardware/firmware of the crypto module, thedisplay will automatically generate a message. The crypto module canactively respond to a data breach by terminating all trusted processes,make sure that any unprotected private data is encrypted and stored,erase unprotected keys, and block any further requests for trustedprocesses. In essence, the trusted display provides feedback to the userof a tamper event.

A second value of the trusted display 260 is the ability to confirm atrusted CM operation was completed—meaning the CM is capable ofperforming atomic operations, i.e., a single function at one instance intime with no other software thread running such that no other temporaryregisters are being used by other functions and the heap and stackregisters (which keep track of the jumping pointers) are only beingaccessed that that single function. In other words, during the processthe trusted display is designated to show just the intermediate resultsand no other application can interrupt. With the trusted CM display 260any given cryptographic operation is guaranteed to run to completion andthe intermediate results of a primitive operation cannot be modified.

The main security advantage of the bi-stable display technology is thatonce the elecrophoretic pixels are changed, they remain in this positionand the contents created on the display remain in place without anyexternal power supply (i.e. the smartphone). At the same time, visibleinformation on the trusted display 260 can neither be deleted normanipulated from outside. Additional power is only needed to write newdisplay contents and this is only possible through commands from thecrypto processor within the CM.

Another unique security advantage of the bi-stable segmented trusteddisplay 260 on the crypto module 200 is the capability to eliminate orreplace the need to print the user's name, role, card expiration data,and even photo on the outside of the card. Removing sensitive printeddata on the card and storing it electronically inside the CM 200 makesit significantly more challenging for an adversary to counterfeit theCM.

Furthermore, the user's electronically stored role, access privileges,and time-bounded access information can be scrolled on the segmenteddisplay to provide the verifier more granular data. Scrolling data onthe segmented CM display 260 can provide any type of more detailedsensitive user data without exposing the data by printing it on thecard. This type of data includes, social security number, date of birth,blood type, rank in military, country of citizenship provide,immunizations, special access privileges, vehicle registration, andmore.

Another unique security advantage of the bi-state segmented trusteddisplay 260 on the CM 200 is to show the specific photo files decryptedand forwarded to the smartphone verifier. In this use case, a filecontaining a sequence of portraits of the CM owner at various angles, oreven video scenes can be forwarded to the verifier's smartphone device.This “video Identification on card” technology means that no sensitivebiometric data has to be transferred to an external documentverification device without that entity being approved by the CM owner.

Yet another feature of the CM display 260 is for use in eIDapplications. One-Time-Passwords (OTP) can improve the security oftransaction-based on-line sessions. CM display 260 can facilitate aSecure Password Protected Authentication Channel (SPAC). The use of anoptical channel implemented by a flexible display for secure passwordtransmission in combination with a cryptographic procedure is nowfeasible. The CM trusted display 260 in this use-case acts assecurity-enforcement component to establish secure and authenticatedradio frequency communications between the NFC CM and smartphone.

Layer 4.5: Customized Data Bus Between Crypto Processor and TrustedDisplay/Memory

In FIGS. 2 and 3A another security feature of the crypto module is acustom data bus between the cryptographic processor (242) and trustedmemory (232) and trusted display (234). Sensitive data is transferredbetween these components on the Printed Circuit Board (PCB) that arepotentially vulnerable to probing attacks. Probing can be eitherphysical using microprobes or with non-intrusive imaging tools such asX-Ray/Terahertz microscopy, SIM, or ion and electron beam equipment.

Countermeasures to protect these two data bus on the PCB include theConformal Tamper coating detailed in Layer 7 (201). In addition, thesetwo data busses (232, 234) are customized using three (3) noveltechniques.

First, the buses between the trusted memory (234) chip/trusted display(234) driver chip and the secure cryptographic microprocessor chip (242)is fully programmable to bit mapping of an order between a leastsignificant bit and a most significant bit. This is a one-time,irreversible, and unique for each crypto module. The advantage ofuniquely customizing the order of each data bit to each crypto module(200), requires the hacker to expend significantly more time is to toprobe and extract meaningful data. Moreover, automated software toolscannot be employed.

Second, all circuitry used to transmit data across the bus employscomplimentary logic using a redundant 2-wire (dual rail) design. Thepurpose of this design reduces the small variations and glitches inducedon the supply power supplies when transmitting the data. Obfuscation ofthe transmitted data makes it significantly more challenging for anadversary to identify and extract data being transmitted betweenintegrated circuit components. This defensive technology uses self-timeddual-rail logic. In dual-rail logic, a ‘0’ or ‘1’ is signaled not by alow or high voltage on a single wire, but by a combination of signals ona pair of wires. For example, ‘0’ may be ‘LH’ and ‘1’ may be ‘HL’. Whenused in self-timed circuits, ‘LL’ signals quiescence. Another advantageof dual-rail encoding is reduced data dependent power consumption as allstates have the same Hamming weight. Dual-rail encoding is notsufficient to guarantee a data independent power signature. The pathtaken by each wire could vary resulting in different wire load. Yetanother attribute of the dual rail bus design is to allow reliablepropagation of the tamper alarm signal from tamper film of Layer 7 (201)to the crypto processor (242).

Third, the custom data buses (232, 234) also integrate a check sum orerror correction circuitry on the dual-rail design. If data errors areserendipitously injected into the bus by a hacker, the check sum logiccan detect and self-correct these injected bits. An inherent drawback ofthe dual rail design is fragility: bugs tend to cause the emergence ofthe unwanted ‘HH’ state, which propagates rapidly throughout the circuitand locks it. Implementation of the customized check sum/errorcorrection circuitry reduces the sensitivity that single data bitfailure is likely to cause the output of sensitive information.

Layer 6: Crypto Module

The fundamental role of the CM 200 is to provide an independentisolation trusted processing environment outside the smartphone. The CM200 achieves this in two ways. First, the hardware design preventsaccess to or monitoring of the internal operations of both token andsmartphone. Second, the CM secure cryptographic functions executedwithin the CM never expose or exports critical data like private keys,user authentication data, trusted processing results, or other likedata.

The crypto module 200 defines a standardized isolation environmentlinked to a commercial smartphone in which security software/firmwarecode, data and resources are processed outside from the main operatingenvironment, software, and memory in the smartphone.

The security functionality of the crypto module is detailed below.

Layer 7: Anti Tamper/Tamper Evident CM Encapsulation

Because the crypto module 200 is a system comprised of many chips and adisplay, the encapsulation material around the CM is protected againsttampering. Most vulnerable to attack are physical probing or indirectprobing to extract data off the internal data busses, memory, or IC's.

Anti-tamper technologies to protecting a single integrated circuit towithstand multi-million-dollar attacks have evolved to protectintellectual property and reduce the potential attack surface. Manychips now implement non-standard attack-resistant logic styles,protective mesh layers, passive tamper resistive tamper evident, andactive attack sensors. An effective anti-tamper solution encapsulatingthe entire printed circuit board (PCB) has not emerged againstnon-invasive and semi-invasive analysis techniques. The layer 7encapsulation provides the structure and method for this method.

The most effective way to secure the CM 200 is to include multiplelevels of security features to each encapsulation layer. The cryptomodule encapsulation layers include a conforming anti-tamper pottingmaterial, UV cured binding adhesive, and Teslin with extruded tampertaggants, customized covert and/or forensic security inks, and polyestertop lamination. Each lamination layer incorporate one or moreanti-tamper security features.

The first layer of tamper protection on the CM is a conformal tamperthin film coating printed over the front and obverse sides of thePrinted Circuit Board (PCB) using UV/Visible light to help streamlinethe curing processing. The objective of the conformal coating is toachieve a higher anti-tamper (AT) level of protection withoutcompromising circuit performance. The use of AT technologies prevents orslows an adversary's attacks by increasing the time it takes for them toreverse engineer and design a counter to the system.

The first tamper layer is a hard opaque potting material encapsulationof multiple chip circuitry CM or strong opaque on front and obverse sideof the PCB with removal/penetration attempts causing serious damage.

The first encapsulation tamper layer base is comprised from urethane(provides a hard, durable potting coating that offers excellent abrasionand solvent resistance), epoxy (excellent resistance to moisture andsolvents, consisting of a two-part thermosetting resin), or ceramics(thermal spray that shields direct access to PCB). It is opaque andresists solvents, heat, grinding, and other techniques that have beendeveloped for reverse engineering.

Other tamper compounds are mixed within the base material to protectagainst micro-probing attacks. Compounds mixed within the base urethane,epoxy, or ceramic potting material are design to not only shieldelectromagnetic emissions but also block outside electromagneticmicro-probing. These compounds can etch or automatically destroy theunderlying components on the crypto module circuitry when an attempt ismade chemically to break through the protective layer.

Various compounds mixed within the opaque potting material arespecifically designed to shield against different types and instrumentsused in probing attacks. These compound materials and esotericcombination of materials include;

-   -   ground metal compounds—reduced the effectiveness of remotely        resetting/setting security fuses or memory by UV light or        visible light. These metal compounds mixed with the potting        material effectively shield attacks from Voltage contrast        Scanning Electronic Microscopy tools.    -   Graphene—has extraordinary properties as an electronic        conductor, thus greatly reducing the effectiveness of probing        with electron ion beam and Focused Ion Beam (FIB) probes.    -   Carbon nanotubes, Carbon allotropes, carbon buckypaper film, and        carbon fullerene structures include other spherical, ellipsoidal        and tubular shapes, all of which capture and electrons from the        focused electron and ion beam utilization tools.    -   Synthetic Diamond in ground or sheet form which shield electrons        from penetrating while providing a hard mechanical substrate        which destroys underlying CM circuitry when potting material is        chemically removed. Synthetic diamond can also help shield from        tools such as Focused Ion Beam machines that can ballistically,        dislodge, or sputter electrons on the surface of IC substrate.    -   Quantum dots are minute semiconductor crystals that favorably        change the optical properties that are governed by the size. The        size alone of the crystal fine-tune the photon absorption or        emission spectra without requiring a complicated change of        material composition or stoichiometry. This becomes important        shifting (stoichiometry) frequency of probes used to exact data        like x-ray, laser voltage, Scanning Electronic Microscope (SEM),        and UV scanning machines to the light frequencies that the        on-chip silicon light sensors can detect and match the bandgap        of silicon.

A tamper mesh acts as a continuously powered sensor in which all thepaths are continuously monitored for interruptions and short-circuit.For the multichip crypto module PCB, the mesh covers all the sensitivecomponents of the crypto module object and the data busses. The activetamper detection hardware circuitry is located within the cryptographicprocessor (242).

The tamper mesh film is the only active tamper element of the ConformalTamper Coating/Tamper evident encapsulate (201). Since there is nointernal battery embedded with to the crypto module, tamper detection isonly active when the CM is powered parasitically by the smartphone.However, when combined with the passive potting material infused withother compounds, the conformal coating achieves significantcountermeasures to attacks and probing.

This described security layer extends the protective boundary from thecryptographic processor anti-tamper layer (243) to the entire thin filmcryptographic module (201). Extending the tamper boundary providesrobust protection to the data buses (232, 234) connecting the chipswithin the crypto module.

The tamper mesh film embedded within the potting material of theconformal tamper coating integrates electronic sensing and detectorsthat are processed with circuitry inside the crypto processor (242). Thetype of sensors include:

Continuity Mesh Sensor—a mesh of thin conductive traces in the filmprovide anti-probing barrier to the crypto module. When the mechanicalprobe penetrates through the mesh, a conductive trace is broken whichthe detection circuitry can detect a continuity change.

Power—Glitch Sensor and/or internal clock Manipulation—Fast signals ofvarious kinds may reset data or cause program being executed within thecryptographic processors to jump or skip instructions if the powerglitches are applied at the precise time. The program counter is alreadyincremented automatically during every instruction cycle and used toread the next address, which makes it an ideal vector of attack if theadversary can generate a condition to change the counter externally byapplying a short high voltage or current spike. The power glitch sensorand circuitry protects against these attacks.

Under voltage/Over voltage Sensors—Non-invasive attacks include playingaround supply voltage and clock signal. Under-Voltage and Over-Voltageattacks could be used to disable protection circuit or force theprocessors to do wrong operation. For these reasons, voltage detectioncircuit is needed to prevent nefarious manipulation of data within thecrypto module.

Anti SPA & DPA Sensor and Circuitry—Simple Power Analysis (SPA) andDifferential Power Analysis (DPA) are attacks which extract data fromprobing the power supplies of the target circuitry. They measure thesmall variations in current and voltage coupled these DC suppliessignals. The minute capacitance and resistance generated by theswitching logic have been observed and correlated to sensitive databeing executed within chips and transferred between chips. One of themore susceptible components within the crypto module is the data busesbetween the crypto processor and trusted display/memory. Drivers on theaddress and data bus often consist of up to a dozen parallel invertersper bit, each driving a large capacitive load. They cause a significantpower-supply short circuit during any transition. Changing a single busline from 0 to 1 or vice versa can contribute in the order of 0.5-1 mAto the total current at the right time after the clock edge, such that a12-bit ADC is sufficient to estimate the number of bus bits that changeat a time. The RF power coupling, the internal voltage regulators, andthe conformal coating prevent access to the power supplies needed forSPA and DPA attacks.

Light Sensor—Many non-evasive machines like x-ray, scanning electronmicroscopy, and focused electron and ion beam utilization usewavelengths of light similar to a silicon detector. Placing thesesensors within the conformal layer in combination with some heavy metalelements like neodymium (a soft silvery metal) provides the ability tostop the higher x-ray frequencies at the same time converting to lowerfrequency ions that are detectable by the silicon sensor. A simple lowcost silicon light sensor combine with the proper compounds can detectand prevent attacks from advanced circuit imaging equipment.

Temperature Sensors—There are several attacks that a hacker externallyand non-evasively chills the circuit forcing small charges that defineand retain the value of a memory cell even when power is removed. Atemperature sensor in the conformal tamper coating (201) processedwithin the crypto processor (242) counters this attack. Cooling memoryto extract data is called data remanence. This is the capability ofvolatile memory to retain information stored in it for some period oftime after power was disconnected. Static RAM contained the same key fora long period of time could reveal it on next power on. Other possibleway is to ‘freeze’ state of the memory cell by applying low temperatureto the device. In this case static RAM could retain information forseveral minutes at −20° C. or even hours at lower temperature.

The encapsulation layer (201) provides detection of direct mechanicaland electronic probing activities that are intended to extract the datawithin the CM. The conformal tamper coating provides resistance fromattacks using, x-ray, scanning electron microscopy, and focused electronand ion beam utilization. In addition, this tamper layer also providesindirect reverse engineering attacks. An example is a simple poweranalysis; in which a device's low-level self-radiated energy is sensedand analyzed, thus giving insight to the operation of that electroniccomponent. The conformal coating will block this type of attack.

The core card body of the CM also employs multi-layered composite ofmaterials and techniques to deliver greater security and functionality.This core card body material being made from a synthetic material calledTeslin™. Robust anti-counterfeit, tamper-evident properties of Teslinare provided by polyolefin hydrophilic properties of the material thatare custom infused with micro-taggants that fluoresce or leach die whenprobed. The lamination layers are designed such that physical tamperresistive layers will destroy the circuitry if removed.

Combined the covert features embedded into lamination substrate, thecore card body can be verified through quick visual inspection usingsimple equipment such as ultraviolet (UV) flashlights and infrared (IR)pens if any tamper has occurred. The UV taggants are easilydistinguished as a unique optical “fingerprint,” and because they areeasily discernable on the edge of a card. IR tangents provide additionalauthentication options with enhanced readers. Embedded UV and IRsecurity markers cannot be replicated by copy machines or printprocesses.

The System Environment

As shown in FIG. 3A, the present invention provides a cryptographicmodule or Crypto Module 200 for use with a commercial smartphone overthe NFC channel in the smartphone. The Crypto Module includes a separatecryptographic processor 242 in the crypto module 200 that iscomplimentary and compatible with the smartphone cryptographic processor112. The CM cryptographic processor 242 integrates a programmablecryptographic library of algorithms.

In addition, most vendors NFC transceiver chips incorporate both aprogrammable hardware processor 116 and secured memory 113. The securedmemory 113 can store symmetric or asymmetric cryptographic keys for theNFC channel encryption or sensitive user data like credit card data,public key splits, or other sensitive user data.

Encapsulated messages between the Crypto Module and smartphone areencrypted so that even if intercepted, no content can be extracted. Thestandard NFC message encapsulation format for information exchange isNFC Data Exchange Format or NDEF. It is a binary message format forexchange of application payloads of any type and size within a singlemessage. A type, a length, an optional identifier, describes a payload.Possible types are URIs, MIME media types and NFC-specific types. Theoptional identifier may be used to handle multiple payloads, andcross-reference between them. Payloads may include nested messages orchains of linked chunks with unknown length at the time the data isgenerated. NDEF is only a message format and keeps no knowledge ofconnections or logical circuits.

As shown in FIG. 3A, a commercially available mobile device 100 such asa cell phone typically will have an NFC baseband chip 110 having acryptographic or secure processor 112, a secure memory 113, an EEPROM114, an EEPROM interface 115, control and ALU processor 116,anti-collision firmware 118 and a bus 117 that provides communicationsbetween the cryptographic processor 112 and the Control and ALU 116. Themobile device 100 further has an antenna matching network 120 and anantenna 130.

A cryptographic module 200 in accordance with the present invention hasa first NFC antenna 210 with an associated antenna matching network 212,a second NFC antenna 220 with an associated antenna matching network222. The Crypto Module 200 further has a bus isolation microcontroller230 having an EEPROM 232, an EEPROM interface 234, anti-collisionfirmware 236, Control and ALU processor 238 and Authenticationapplication interface (API) 146. The Crypto Module 200 further has asecure microprocessor 240 having a cryptographic processor 242,authentication firmware and hardware 246 within the crypto processor 242and EEPROM 248. A bus 250 provides for communications between the busisolation microcontroller 230 and the secure processor 240. The CryptoModule 200 further includes trusted display 260.

Leveraging the hardware encryption processor 112 incorporated in thecommercial smartphone transceiver chip, the crypto module architectureintegrates a compatible hardware cryptographic processor 242 in thedesign. Shared symmetric cryptographic AES or equivalent keys arepre-stored during provisioning of the smartphone 100 and CM 200respectively. The cryptographic key for the smartphone 100 is stored intrusted memory 113 and sometimes called the “secure element.” Anexpandable memory (not shown) in the crypto module 200 as well as theintegrated memory within the crypto processor 242 is trusted and secure.The Crypto Module memory can be parsed into separate trusted datacontainers during provisioning for multiple trusted applications. Forexample, a separate memory container can be provisioned in the cryptomodule to store the NFC data channel encryption key.

Utilizing the existing NFC hardware in the smartphone 100, the datatraveling between the smartphone 200 on a data bus 117, through the airgap of the NFC, through the data bus 250 in the Bus IsolationMicrocontroller 230, and finally to the secure processor 242 is fullybi-directional encrypted. Data in transit within the crypto module 200is decrypted and protected by other layers of defense, for example, inthe Crypto Module circuitry 260. By integrating a common security NFCprotocol and compatible hardware cryptographic processors on each end ofthe data channel, a more effective and secure framework is provided forimplementing a suite of new security functions.

Power-Up Mode

The Crypto Module 200 is designed as a hybrid device meaning it is apassive token in that it does not have a battery, yet it immediatelyestablishes bus control upon sensing the NFC field from the active(powered) smartphone 100. The smartphone antenna design with a large(2500-4500 mamp/hour) battery typically amplifies the signal to thereceiver—the crypto module. Although the minimum or maximum power valueactually transmitted to the crypto module is NOT defined in the NFCstandard.

The communication technology is based on magnetic field induction froman active (battery powered) device like a smartphone. A passive devicelike the CM 100 does not contain a battery, but rather, is parasiticallypowered by an induced magnetic field of the smartphone. A typicalpassive token is powered up when the magnetic field is strong enough toinduce the needed voltage in the passive token's antenna so that itsinternal circuitry can operate. In this scenario, the typically passivetoken responds and defaults as the passive device. When activated, thetypical passive token simply responds to commands sent by the activeinitiating device (smartphone).

The novel architecture of the present invention employs a hybrid NFCinteraction between the active smartphone 100 and passive CM device 200.However, the crypto module 200 does NOT default as the passive device asa responder to the initiating smartphone 100. Rather, when sensing theinduced NFC field, firmware within the CM 200 switches control of thedata interface from the smartphone 100 to the CM 200. With this newhybrid NFC protocol architecture, all actions like authentication ortransmitting the contents stored in memory are initialized andcontrolled by the crypto module 200 not the smartphone 100.

Essentially, the control of the NFC data bus is switched from thesmartphone 100 to the crypto module 200. The crypto module 200, eventhough it's being parasitically powered by the smartphone 100, is anindependent entity capable of executing one or more trusted processes.

To effectively switch the control of the NFC bus from the defaultsmartphone 100 (that is powered) to the Crypto Module 200, two NFCantennas 210, 220 are implemented in the Crypto Module 200.

The basic Crypto Module antenna design is a square loop withapproximately 3 cm sides, rounded corners and 9 turns. Layout of themetal traces and geometry comprising the CM antennas is straightforward,as they only support passive communication mode (i.e. they do not haveto generate their own magnetic field like the smartphone). The presentinvention, however, is not limited to this antenna architecture.

The analog tuning antenna circuitry in the antenna matching networks212, 222 does require careful tuning using discrete components tocalibrate and optimize the Q-factor, the resonance frequency tuned nearthe 13.56 MHz carrier frequencies, and to pre-shift the carrierfrequency for the materials used to encapsulate the crypto module 200into the card form factor.

The two antenna design for the crypto module 200 is functionally uniquefor two reasons. First, the inductive power coupling mechanisms from thesmartphone 100 to the Crypto Module 200 is more efficient when using twoantennas. This is based on the resonant frequency, the number of turnsand the effective area. Although providing a better Q-factor, the numberof turns cannot be infinitely increased. Integrating a second antenna220 on the opposite (obverse) side of the Printed Circuit Board side(FIG. 3B) with an identical antenna 210 on the front side is effectivelycoupling in more power. Antenna #1 (210) and Antenna #2 (220) couplepower into the Crypto Module 200 using analog circuitry in the antennamatching networks 212, 222. Placing, metal components, signal traces, orground planes outside the two-antenna coil loops optimize the inducedmagnetic field power coupling further.

Tin the Crypto Module 200 power is needed to supply the bi-state display260, display driver Integrated Circuit 204, cryptographic microprocessor242, bus controller processor 230, analog antenna tuning and filtercircuitry 212, 222, and non-volatile memory. With a maximum of 10 mampsavailable from the smartphone NFC antenna, a multiple antenna design onthe CM side is capable of coupling in enough power.

Second, the two-antenna Crypto Module design improves security. Thedesign provides a means to truly isolate the data and power between thesmartphone 100 and a Trusted Execution Environment (TEE) required forthe crypto module 200.

This TEE isolation is achieved by a novel method of using both NFCantennas 210, 220 during the initial power up sequence of the CryptoModule 200, followed by assigning the NFC data bus to antenna 210exclusively. A separate microcontroller 230—called the “Bus IsolationProcessor” or “Bus Isolation Microcontroller” is included in the CryptoModule 200 to provide physical and temporal isolation.

The flow diagram in FIG. 4 details the sequence of steps that isolatethe Crypto Module 200 during power up. The Crypto Module 200 is powered100% parasitically by the smartphone 100. The NFC standard assumesReader/Writer NFC operational mode. The smartphone 100 is the activereader device since it has a battery. Likewise, in Reader/Writer mode,the crypto module 200 defaults (as defined in the ISO standard) as thepassive device responding to the smartphone. Even though the NFCstandard was later appended with ISO 18292, including tokens that couldbe internally powered, the firmware programmed into the Bus IsolationMicrocontroller 230 chips will still set the CM as the Master busdevice. Therefore, the flow diagram isolating the internal TEE CryptoModule data bus is still applicable. A flow diagram later in thisapplication describes how the same security architecture works for anymode of the NFC standard.

The process begins (402) when the user brings the Crypto Module withinapproximately 1 cm of the smartphone (404). When the user brings theCrypto Module within approximately 1 inch to the smartphone, both theinternal cryptographic processor and bus isolation processor sense an RFfield (406). The Bus Isolation processor powers up faster than thecryptographic processor thus it is the first to sense any commands sentfrom the smartphone NFC transceiver.

Both Antenna #1 and #2 couple power to the crypto module (410). Oncefully powered (420), the Bus Isolation Processor ignores thesmartphone's initiator request and sends an initiator return pingrequest to the smartphone. The reason why the Bus Isolation Processorignores the smartphone request is so that the CM can be established asthe active or master device on the NFC bus. An acknowledge response isreceived back from the smartphone (thanks to the added active card ISO18292 standard addition) and it immediately turns off the NFC data portfrom the second antenna to the crypto processor (430).

Note, by disabling the Crypto Module data port in NFC antenna #2 (230),it does not disable the carrier frequency of antenna #2. At this pointin the process the Crypto Module is inductively powered by both Antennas#1 and #2 (410), yet the only data communications link between thesmartphone and Crypto Module is through Antenna #1 (440). This subtleyet obscure sequence of steps that are fully compliant with the NFCstandard. These steps allow a passive card like the CM to beparasitically powered while at the same time allowing the CM to be themaster data bus controller and thereby become trusted hardware forsecure processing (450).

ISO NFC standards have defined three (3) different communications modes.From the smartphone perspective, with the exception of steps 510, 520,540 and 550 shown in FIG. 5, the power and configuration settings of theNFC connection follow the standard.

The first mode is peer-to-peer. In peer-to-peer mode, two NFC devices(i.e. smartphone #1 & smartphone #2) can exchange data such as virtualbusiness cards. When the CM is brought within range of the smartphone(504), the NFC protocol will determine whether the CM is a batterylesstoken (510). Depending on whether the token is batteryless, thesmartphone sets up communications under a correct ISO (512 or 514) andswitch the bus control to the CM (520) and performs initial NFCcollision avoidance (522). However, when the smartphone protocolattempts to configure the data channel (530) it will realize that it'sin Peer-to-peer mode and terminate the communication exchange (534).

In the 2^(nd) mode—Card Emulation mode, data such as credit card ortransit data is stored within the active powered smartphone devicewhereby the user's phone replaces the card itself. Following thestandard NFC powering up sequence (504), the smartphone will realizethat the CM does not have a battery (510), attempt to switch control tothe CM (520), and configure the CM/smartphone into the Card Emulationmode (530). However, no data will be transferred from the CM to thesmartphone and an end of operations command is issued (532).

The 3^(rd) NFC communication mode is called Reader/Write. The method ofthe present invention operates in the Reader/Writer mode. TheReader/Writer operational mode has duplex two-way communications andallows for battery powered or passive tokens. Following the NFC standardduring the power up mode, the CM can have a battery as defined in ISO18292 or be a passive token without a battery like ISO standard 14443.In either battery or batteryless CM case, the Crypto Module assumescontrol over the data bus (520). Upon completion, the data bus encryptsthe channel in both directions using a pre-stored symmetric key (540).The crypto module is now securely tethered to the smartphone to proceedwith any requested secure processing (550). The smartphone utilized asingle NFC chip to and are fully compatible with all threecommunications modes.

Because of the relatively short communication range in NFC in general,little effort has traditionally been put into security analysis of suchprotocols. It seems that the short signal range leads people to believethat the channel cannot be tampered with. Although inherently moredifficult to eavesdrop on an NFC mode compared to other smartphoneinterfaces, the present invention focusses on only adding security tothe NFC data channel.

The NFC standard defines two modes of operation, active and passive. Inpassive mode the initiator generates a RF field to energize the target.In turn the target responds using a load modulation scheme on the fieldgenerated by the initiator.

In the typical card-reader smartphone NFC application, the smartphone isthe active/initiator and the token is the responder or passive devicepowered up parasitically by the smartphone. In active mode each devicegenerates its own RF field and modulation. The initiator sendsinformation or commands on its field, and the responder answers onanother field.

With security architecture and method of the present invention, theseactive/passive roles are switched between the smartphone andCryptographic Module—without modifications of the standard NFC protocol.As the Crypto Module 200 is brought into the inductive field of thesmartphone, firmware code programmed within the smartphone switches theinitiator/responder roles. The standard NFC terms of “Active/Passive”role or modes become confusing. For clarification, we use the “Masterdevice” for the active or initiator mode and “Slave Device” for thepassive or responder mode.

Implementation of the system and method for creating a trusted workspaceon a commercial mobile device requires three separate processes: (1) theprovisioning of the system; (2) the initialization and Boot-up; and (3)the transition into the Trusted Work Space. Each of these will beexplained in the paragraphs below with discussions of appropriatebackground.

It begins with the provisioning of the CM and the user's Smartphone. Theuser is registered, using the government PKI system or equivalent, forthe purpose of establishing his identity. Once accomplished, thecertificates are created and the private keys are loaded each onto theCM and the Smartphone, as per normal PKI procedures. The Smartphone isalso configured with a Redwall Type 1 Hypervisor, a software programthat manages multiple instantiations of the operating system on thesingle Smartphone computer. The Hypervisor manages the system'sprocessor, memory and other resources to allocate to each operatingsystem its requirements as well as monitoring their activities.Hypervisors are designed for particular processor architectures and mayalso be called virtualization managers. There is no connection betweenthe operating systems except for the Hypervisor. This allows one virtualmachine/OS to operate under the control of one password and the other tooperate under the second with no leakage between them, Data entries toeach are entirely separate.

In the provisioning process the first user password is created to enableaccess to the basic Smartphone system. It is stored in the CM for latercomparison to the typed entry. Connections to the outside world,Internet, web connections, email, etc. are allowed in this basic system.If keystroke monitoring malware is introduced it will reside on thissystem, having been downloaded from outlaw websites or introduced viaphishing emails. Once passwords are detected and recorded by the malwarethey would be offloaded through surreptitious connections to the outsideworld for later use in accessing this portion of the machine.

In addition, during the provisioning, a special random password iscreated and loaded into a particular register on the CM that the userwill only use for access to the second level compartment OS (the secondkey in the previous illustration). It is not to be used for anythingelse and will only be called for during the transition between the basicOS and the compartment OS. In fact, it can only be accessed visually onthe secure display while using the basic OS, there will be no other wayto read the contents of this memory location. And it is only availableto one who has successfully identified himself and gained access to thefirst level/basic OS of the CM and Smartphone.

During the transition process between the two virtual machines, the userhas on his CM secure display the special password and as he keys in thecommand on the Smartphone keyboard to make the switch to the compartmentOS and is asked for a password, he then uses the password that he hasvisually accessed from the CM, thereby completing the transition.Several important notes here; he has obtained the password from thesecure display of the special register on the CM and he has not keyed itinto the basic OS so it cannot have been compromised or recorded by themalware. The keystroke monitoring malware active on the basic OS doesnot operate in the compartment OS and cannot detect the entry of thesecond password. And even though the keystroke monitor has compromisedthe contents of the basic OS machine, via the first password, it has notcompromised the contents of the compartment OS unless the intruderactually has the CM physically in his hands and can read and use thecontents of the special register.

The two OSs are needed because the first is required to identify theuser and to provide authenticated access to the register containing thepassword needed for the second OS. The second OS is then needed for thesecure data operations.

He can make secure calls between his compartment OS and anotherSmartphone compartment OS with the same privilege definitions using aVPN connection and a Peer-to-Peer protocol. The called party canvalidate the privileges of the calling party by an out-of-band enquiryconnection to the provisioning station or to a properly configuredCertificate Authority or an OCSP server for checking revocation statusin the PKI Network. He can also access and operate on databases withinthe compartment OS without fear of compromise.

The user can now easily switch between the two OSs with the appropriatecommands and passwords, still with no information transfer between thetwo except visual. This might be needed to gain access to information inthe outside world or to make normal audio or IP communicationconnections, again using the basic OS and the a Peer-to-Peer connectionswhen required for sensitive connections. But note that when doing this,all keyboard entries could be compromised.

These very convenient modes of operation can only be realized throughthe use of the CM because of the visual access to the secure memory onthe CM. No other security device has this capability.

CM Secure Bootup of a Commercial Mobile Device

A comprehensive “chain of trust” must be established to verifycommercial a mobile device is configured in a known trust state. Thissecurity service should protect any physical hardware attacks, protectagainst malicious code inserted on Smartphone and prevent anynon-authentication users from gaining access to apps or data on theSmartphone while in use.

The CM ensures the chain of trust by cryptographically verifying the CMmemory, low-level bootloader, secondary bootloader, OS kernel, OS, andfinally the mobile device apps.

One primary security function of the CM is to be used as a secureboot-up device as show in FIG. 7. This ensures that the Smartphone bootsup from a cold start in a trusted manor. In the first step, the CMverifies the low-level bootloader. By design, this bootloader is assmall as possible and has minimal capabilities. The low-level bootloaderis stored in the hashed digital signature in the CM memory containerduring provisioning. At cold start, the CM performs the cryptographicmeasurements of this startup and compares it with the pre-stored digitalsignature that proves that the low-level bootloader source code has notbeen modified or changed.

The next step in the trust chain is to initiate, execute, and validatethe recovery Mode or secondary/second stage bootloader. This bootloaderis code that is executed before any Operating System starts to run andis more sophisticated then the low level bootloader. Like the low levelbootloader, the secondary bootloader is a collection of files thatensure that the CM configures a specific mobile device in the desiredtrusted state. If additional trusted applications or user privilegeswere to be issued on a mobile device by the CA, this file andverification routine would be modified whereas the low-level bootloaderwould stay the same.

The next sequence in the trusted boot-up process is verifying the OSKernel. The kernel's main function is to control, monitors and managethe mobile device's hardware—especially the peripherals and I/O's. Itincludes verifying a large block of source code that bridges the mobiledevices software and hardware.

In the final boot-up process the CM verifies the mandatory code signingfor the OS to the Apps.

To execute a secure boot-up for mobile devices the CM requires not onlymemory but specific cryptographic functions for trusted processing.Although the trusted processing requirements vary slightly depending onthe Operating Systems and Smartphone architecture and capabilities,general core security functions are shared. The core security functionsrequired in the CM include:

-   -   1. The SHA algorithm for hashing;    -   2. The SHA based HMAC for command authentication;    -   3. Capable of performing atomic security operations (This        property means that security operations run to completion and        that the intermediate results cannot be modified or exposed);    -   4. A monotonic counter;    -   5. Capabilities for secure key storage and secure data storage;    -   6. Extensions that allow the minimal set of cryptographic        engines (SHA, RSA and RNG) to be used to support security        protocol;    -   7. Symmetric cryptographic engines, other hashing algorithms        like MD5, and support for additional asymmetric algorithms;    -   8. Reduced size and power dissipation (To achieve this,        architectures that allow the CM to be 100% parasitically powered        by the Smartphone via the NFC interface);    -   9. Internal architecture with 160 bit Platform Configuration        Registers (PCR) that are used to store information about the        current state of the platform;    -   10. Support for multiple isolated execution environments in        which trusted applications and services are executed within CM;        and    -   11. On reset, volatile memory used by trusted applications and        services must be totally zeroized.

The sequential boot-up process described above is largely transparent tothe user. It is launched when the user brings the CM to the Smartphone.The user is prompted to select a desired security level, then thesequential steps run in the background and autonomous, only showingverification results on the CM display.

Meeting a criteria level for a trusted environment can be a lengthy anddifficult process with great impact if the steps are not segmented. Thissecure function is modular and can easily be configured to differentSmartphone Operating Systems, Smartphone models, and mobile devices.

Cryptographic Authority

In any mobility architectures, a stand-alone Cryptographic Authority(CA) is defined as a network service. (see red box in FIG. 8) The CA ismandatory for issuance of the root keys to the CM and Smartphone.

During initialization & provisioning, the CA writes immutable data andcode in separate memory containers within the Cryptographic Module aswell as a split key to the Smartphone. Like the CM, the CA is astandalone trust end point. This mobile security element should alwaysbe developed and maintained by the provisioning authority. The highestdegree of confidence in the vetting process is used to establish theidentity of the individual to whom the PKI cert was issued.

The CA performs identity proofing when first enrolling the userin-person. The provisioning process includes generation of a PKIcredential for each access and privilege level permitted, written todata containers in the CM and associated Smartphone.

Identity proofing is more complex and lengthy the first time an accountis created and in most cases need not be repeated in its entirety duringsubsequent access, depending on the details of the relying party policyand the sensitivity and criticality of actions performed using theaccount. It is the process of establishing confidence that anindividual/organization using a credential that is known to the system(e.g., login name, digital certificate) is indeed theperson/organization to whom the credential was issued.

The proposed architecture will utilize the existing structure as of ahierarchical PKI. A hierarchical PKI architecture uses a multi-root(PKI) certificated authority model including a sole Root-CA withsubordinate intermediate CAs. The subsequent intermediate CAs then haveauthority to issue credentials to users. Intermediate CAs can issueemail (Digital Signature) certificates and authentication certificates.

Under the intermediate CAs are the subscriber's certificates, stored inthe CM.

In addition to verifying certificates with a Registration Authority(RA), the ICM can verify certificates or certificate chains. The CMcryptographically verifies the identity of the user to generate a newtime-limited credential. Verifying the time limited derived credentialslocally greatly simplifies the overhead if done globally by the networkRA. The CM also has the capability to update any information or keys orexecuting revocation requests received from the network CA.

The architectural challenge is integrating the trusted CA securely withthe network and CM. The CA is implicitly trusted and employs all layersof protection and isolation.

Creating root key splits, certificates, revocation lists, remotezeroization of keys and other cryptographic and identity managementservices has always been a separate highly secure process theprovisioning authority must maintain and control.

Driving Down the Complexity

Integrating SW/HW security into the Smartphone requires parsing thesecurity capability into all layers of the mobile architecture whereasthe architecture employing a Crypto Module conjoined via NFC streamlinesthe design. In FIG. 9, the block diagram on the left shows the securefirmware (yellow) and the Secure Hardware (red) required if securitymust be all placed in the phone. The block diagram to the right showsthat that only a single hardware component (red) CM and a singlefirmware Hypervisor within the phone is required when the security isseparated from the Smartphone.

Attributes simplifying this mobility architecture include:

-   -   The CM and CA are red devices. For secret and higher        applications, we assume these are developed and distributed as        Government-Off-The-Shelf (GOTS) components. Having these two        indispensable trust anchors enable the use of a commercial        Smartphone with debatable security.    -   There are NO necessary red security blocks within the        Smartphone. Best-in-Class commercial security features protect        the derived key when in use. All root keys, private keys,        authentication templates, and signature values are store in the        CM and are never exposed to the outside.    -   The yellow Hypervisor is a TYPE-1 class virtualized machine. The        left side Native OS controls the vendor's applications and        resources. The right side OS contains trusted apps downloaded        via a secure channel from a trusted app store.    -   Root keys, certificates, users' privileges, and        configuration/verification digital signature data are downloaded        through the red CA (Cryptographic Authority). The CA is isolated        and utilizes a trusted red input path.    -   Over the Air (OTA) rekeying of Mobile device through yellow        Network service is now feasible.

Not all I/O Peripherals with this architecture are the same. The abovefigure also demonstrates that the NFC, Touch screen/display/keypad, andWiFi are special in comparison to the other base band interfaces likethe camera, sensors, etc.

What differentiates these three Smartphone interfaces are;

-   -   1. The WiFi interfaces with both the OTA and CA network services        through a secure bus. This input is denoted as a multiplexor        rather then a simple I/O block to emphasis that the CM controls        and ensures isolation between the untrusted and trusted data        bus.    -   2. The NFC interface connects to the using a trusted bus.        Although this is a low-level hardware driver, it is typically        allowed access and control from the application layer within the        Smartphone. To overcome this security vulnerability, upon        powering up the CM when within inductive range of the        Smartphone, bus control is transferred to the CM. Now the CM is        fully isolated and can drive and verify all Smartphone        operations.    -   3. Touch screen/Display/Keypad—The Smartphone's primary        interface to the user is the touch screen. This I/O has been a        low hanging target for hackers. Malware capturing users        keystrokes or bypassing PIN-matching algorithms are extensive        and pervasive. Although the CM stores, matches, and displays the        result all inside the module, the user while inputting their PIN        on the Smartphone display may still be vulnerable to attacks. To        stave off these common attacks, a layered approach using a        dedicated encrypted path between the touch screen and CM,        attestation, and the specialized custom multiplexed port should        greatly strengthen the security. Also, the use of the Hypervisor        in the transition between the two OSs will prevent the        surreptitious recording of the keystrokes of the second password        needed to access the Trusted OS workspace.        The Redwall Hypervisor

The roots of the hybrid Hypervisor design began while working with theUSG to detect and understand vulnerabilities in commercially evolvingTrustZones, Secure Elements (SE), virtualization solutions, TrustedExecution Environment (TEE), SE Linux, containerization/sandboxing,custom hybrids like Samsung KNOX™/GD Protected™, and Type I & Type 2Hypervisors. None of these approaches proved effective, failing to beresistive to even basic attacks. More importantly these solutions arevendor specific requiring changes to the driver code or otherproprietary source code if moved to another mobile platforms.Engineering overhead can be many man-years to be operational on a singledevice and are solutions that cannot be migrated at the rate ofcommercial mobility.

The Redwall Hypervisor resides below the Smartphone OS at the kernellevel. The Hypervisor firmware is a custom Android-based ROM (sometimesreferred to as an image) designed to preserve the Smartphone vendor'sproprietary code—only small source modifications are required. Thecustom Hypervisor is ported to a new device and easily modified as newversions of Android become available.

The core security of the Redwall Hypervisor is a trusted securitymonitor that runs alongside the Linux kernel. This security monitor runswithin the hardware of the CM processor while connected. The monitorperforms checks on every system call, as well as on the scheduler. Othersecurity functions that are split between the CM & Redwall Hypervisorinclude:

-   -   Isolation of different personas, privileges: The Redwall        Hypervisor utilizes the CM Suite B cryptographic processor to        provide hardware-based encryption for temporal isolation.    -   Isolation of data and applications at different levels of        sensitivity: The Hypervisor retrieves either the decryption key        or decrypted data from the CM and never presents the data in the        Smartphone registers or memory at the same time. It is simply        not possible to leak data from one persona to another.    -   Reconfiguring or moving between security levels: The Redwall        Hypervisor firmware, called the rCore, is simply an extension of        the Linux kernel that enforces polices. The Hypervisor utilizes        behavioral analysis to define what is, and is not allowed.        Attribute fields for policies are stored in separate memory        containers within the CM. Polices for each access level or        application drive low level system calls, network locations, and        file system locations. These policies can also define and        restrict high-level mobile phone resources like Bluetooth, GPS,        WiFi, microphone, speaker, and camera.    -   By constantly monitoring any changes to the kernel, the Redwall        Hypervisor easily detects the presence of rogue applications.        Attempts to circumvent the OS built-in protections, escalate        user privileges, or execute system calls are also easily        detected. Recent, one-click rooting APK developed in China for        SE Android phones with strict custom polices, as with other zero        day exploits, were detected and did not require modifications or        patches to the Hypervisor.

The Redwall hybrid Hypervisor occupies a very small footprint asillustrated in the figure above. Only a few Smartphone peripheralsrequire robust trusted paths. These include the NFC to CM, thetouchscreen to CM (for user authentication of PIN), the Wifi to CM (forOver-the-air Rekeying and trusted application store), and other I/O portenabling/disabling for each trusted application.

In summary, the Redwall Hypervisor enables secure use of the SmartphoneWhile-In-Use and connected to the Crypto Module. When not connected tothe CM, Data-at-Rest is achieved since no root keys or critical userdata is stored within the Smartphone. The Redwall Hypervisor provides atrusted data path below the OS for sensitive data AND a flexible controlto securely route this data depending upon the enforced security policy.

A method in accordance with a preferred embodiment of the presentinvention for securing a trusted workspace using the Hypervisor is shownin FIG. 10.

Provisioning Secure Code for Nested Access Privileges

The present invention provides for provisioning of secure code fornested access privileges including the following steps:

-   -   1—Register users using Government PKI (or equivalent management        system), check clearance including access privileges and record        details, store in secure mode.    -   2—Create Secure Code, store by name/use/owner, creation date,        for future reference, audit, inclusion in certificates, on OCSP        revocation status list.    -   3—Load secure code onto Alice, Bob's CMs in known registers        during the initialization procedure.        Crypto Module Trusted Memory Containers

One aspect of this patent is that much higher security can be achievedwhen the Crypto Module establishing as the master device, can partitionand encrypt/decrypt separate secure memory containers during write/readrespectively as illustrated in FIG. 11.

Separate secure memory containers (1124-1130) can be encrypted using thesecure crypto processor (1110) embedded within the CM (1100). Thismemory can be part of the secure crypto processor chip or be expandedusing an internal bus to separate non-volatile memory chip(s) (1114).

One security feature of the trusted memory containers is the dataencrypted and decrypted by the cryptographic processor can encrypt anddecrypt data using any one of the suite of algorithms integrated intothe CM.

Yet another security feature of the CM with a trusted NFC is thecapability to apply different cryptographic keys and key lengths tosecure data in the trusted memory containers providing temporalisolation between containers. For example, a Secret key of length 256bits can be used for US military communications while aSecret-but-Unclassified key of length of 196 using the identicalencryption algorithm type can be used for 1^(st) responders.

Yet another security feature of the trusted memory containers is theability to include predefined header files (1141-1144). Attributesheaders for each trusted memory container define access policy, specificuser groups permitted to access the data container, sunset keyexpiration dates, and read/write privileges.

Yet another security feature of the trusted memory containers is theability to pre-define the Read/Write privileges attributes (1141-1144).These attributes can be pre-defined or dynamic.

Access policy privilege can be automatic write and read only (1117) fora special purpose data container such as a secure log file. The securityadvantages of a trusted read only log file provides the capability tosecure log each and every interaction of the crypto module with thesmartphone and user. It provides a method to securely store and forwardall trusted transaction even though reach back capability with thenetwork is not available.

Yet another security advantage of the trusted memory containers are thepre-define user authentication access attribute policies that aredefined for each data container (1141-1144). For example, one datacontainer can allow read/write access with just a crypto module(one-factor authentication), a second container may require password andcrypto module (2-factor authentication), and a third container mayrequire password, CM, and biometric).

Yet another security advantage of the crypto module secure memorycontainers are they are on a separate isolated trusted data bus (1160).It is very difficult for a malicious player to access data transferringthrough this data bus with the many defensive security layers likeactive and passive anti-tamper, encryption, hard-coded userauthentication access.

Yet another security advantage of the crypto module secure memorycontainers are the ability to store multiple user's X. 509certificate/credentials, pictures, contact list and phone numbers,device commands, text, medical records, videos, and other sensitivedata. For example, a user can have a X.509 certificate along with auser's phone number for secret level calls stored in one container(1125). A second data container (1126) can be pre-defined with adifferent X.509 certificate for top-secret calls associated with thesame user.

Yet another security advantage of the crypto module memory containers isthe ability to encrypt and parse files into separate data containers,then send encrypted (tunnel through) the smartphone device to a trustedweb portal or firewall. This provides the capability of a trustednetwork entity to verify the contents of the received memory container.

A Special Purpose Data Container—Secure Audit File

During provisioning, the Cryptographic Authority can parse the cryptomodule trusted memory into many data containers (1105). One specialpurpose container is the Secure Audit file (1121) with aread/write/forward later to access privileges hard-programmed (1117) bythe Cryptographic Authority.

In Auditing, the concern goes beyond keeping the data Secret; it alsopertains to not only the data but how and why it was collected. Itinvolves such particulars as independent monitoring of controls,procedures, transaction history and use of resources.

The Audit Trail is the sequence of events concerning the item beingaudited. One of the more important aspects of auditing is the securityof the auditing information and audit trail.

Audit Security is the protection of these audits records frommodifications for future trusted (provable) review. Without adequatesecurity of this information, it is difficult to prove without a doubtthat the information is true, accurate and has not been modified.

The basis of this patent is that the data protected by the Secure Memoryof the crypto module is protected to the extent that it could be used tosupport any auditing process and that authenticated persons on theSecure Display can view the trail of this audit data securely.

Yet another security advantage of the crypto module is the ability foraudit events that need to be recorded and for non-repudiation. Forexample, transaction history with time stamp, transaction counts, chainof trust, Sarbanes Oxley (SOX) compliance, medical procedure records,document viewing records, the trail of a document having been opened bywhom and when, sequence of events, monitoring integrity checks andrecording their occurrence.

In this class of secure audit file, data can be a rolling tally, i.e.,numbers of event over a past period of time, compliance audits—recordsof actions by host—securely recording successful completion of requiredprocess steps (with witness).

Yet another security element of the crypto module secure auditcontainers are that it offers the opportunity for a witness to securelyaffix his signature to the audit trail contained within the SecureMemory. This witness signature process can be accomplished through theuse of the Public Key techniques.

Yet another security element of the crypto module secure auditcontainers are for time cards, verified time in and out, similar to theold paper time cards and printing clock, except now it is electronic.The audit trail is secure (unalterable) and time stamps can be recordedseparately for performance of different tasks. Since the Crypto Moduledoes not have a clock, a connection would have to be made via a securelink to a real-time clock for this information.

Yet another security element of the crypto module secure auditcontainers is document control, access to facility and use of copymachines if so equipped, with time stamps.

Yet another security element of the crypto module secures auditcontainers is use of resources as in, for example, gas pumps thatcommunicate an electronic record instead of a paper receipt.

Yet another security element of the crypto module secure auditcontainers is passport with border control records, two-way; both thepassport holder and the border control agent hold audits of theproceedings.

Yet another security element of the crypto module secures auditcontainers is property checkout and check-in, equivalent to anelectronic library card.

Yet another security element of the crypto module secures auditcontainers is proof of ownership, as in an electronic automobileregistration.

Yet another security element of the crypto module secures auditcontainers is proof of payment in that the card holder has an electronictransaction record with secure time stamp, if needed.

Yet another security element of the crypto module secure auditcontainers is automatic security event monitoring of any known orsuspected violations of physical security, network or “hacking” attacks.

Yet another security element of the crypto module secure auditcontainers is physical access to, loading, zeroizing, transferring keysto or from, backing-up, acquiring or destroying cryptographic modules.

Yet another security element of the crypto module secure auditcontainers is installation, access and modifications to configurationfiles, security profiles, and administrator privileges for operatingsystems.

The foregoing description of the preferred embodiment of the inventionhas been presented for purposes of illustration and description. It isnot intended to be exhaustive or to limit the invention to the preciseform disclosed, and modifications and variations are possible in lightof the above teachings or may be acquired from practice of theinvention. The embodiment was chosen and described in order to explainthe principles of the invention and its practical application to enableone skilled in the art to utilize the invention in various embodimentsas are suited to the particular use contemplated. It is intended thatthe scope of the invention be defined by the claims appended hereto, andtheir equivalents. The entirety of each of the aforementioned documentsis incorporated by reference herein.

What is claimed is:
 1. A method for creating a trusted workspace on amobile device using a cryptographic security token comprising a securemicroprocessor, a secure bus connected to said secure microprocessor, abus isolation microcontroller connected to said secure bus, said busisolation microcontroller comprising firmware for controllingcommunications through said secure bus to said secure microprocessor, afirst NFC antenna connected to said bus isolation microcontroller, and asecond NFC antenna connected to said secure microprocessor, wherein saidsecure microprocessor and said bus isolation microcontroller are poweredby energy received through said first NFC antenna and said second NFCantenna, and wherein said cryptographic security token receives datafrom outside said cryptographic security token only through said firstNFC antenna, the method comprising the steps of: provisioning thecryptographic security token and the mobile device, wherein theprovisioning comprises: registering a user in the cryptographic securitytoken to establish an identity of the user; creating authenticationcertificates associated with said user; loading private keys on to thecryptographic security token and the mobile device; creating a firstuser password to enable access to a basic system on said mobile deviceand storing the first user password in the cryptographic security token;creating a random password and loading said random password into aregister on the cryptographic security token, the random password onlybeing accessible to the user through a secure display on thecryptographic security token; and storing a low-level bootloader in thecryptographic security token; initializing and booting up thecryptographic security token and the mobile device; and transitioningthe cryptographic security token and the mobile device into the trustedwork space.
 2. The method for creating a trusted workspace on a mobiledevice according to claim 1, wherein the initializing and booting up ofthe cryptographic security token comprises: verifying the low-levelbootloader with the cryptographic security token; initiating, executing,and validating a secondary bootloader; verifying an operating systemkernel of the cryptographic security token, wherein the verifying of theoperating system kernel comprises verifying a large block of source codethat bridges software and hardware in the mobile device; and verifyingmandatory code signing for an operating system of the cryptographicsecurity token to applications in the mobile device.
 3. The method forcreating a trusted workspace on a mobile device according to claim 1,wherein the transitioning the cryptographic security token and themobile device into the trusted work space comprises: writing immutabledata and code in separate memory containers within the cryptographicsecurity token, and writing a split key to the mobile device.